Essential Records: Protecting and Recovery Planning for Business Continuity
While all records are important, not all records are essential to an organization, agency, or its citizens. Documentation of decisions, regulations, proof of identity, medical histories, and historical records to retain a sense of continuity with the past are all records that need to be protected and ensured that they can be accessed in the future. But which records should be considered essential during risk management and disaster recovery planning?
What are Essential Records?
Essential records, sometimes called vital records, are those records, regardless of format or archival value, that are necessary for the continuity and resumption of daily functions and operations of an organization or agency following a disaster.
Business continuity, disaster preparedness, and records protection planning depends on identifying what records are essential to quickly restore your operations. Which records are essential and in what order of priority are specific to each organization based on its function and needs.
How Do I Determine What My Essential Records Are?
Consider the critical functions of your office to help designate and prioritize records of significance. Four factors determine the critical value of a record:
- Mission-critical functions of the agency
- Cost (time, money, operational, and human) associated with potential loss
- The speed with which you will need to access the record when an emergency occurs
- Ability to reconstruct the record
Essential records are important for their content as well as their role in the recovery process.
FEMA’s IPER course recommends prioritizing essential records by time of need[i]:
- Priority 1: Records needed within the first 1-12 hours following an emergency.
- Priority 2: Records needed within the first 12-72 hours.
- Priority 3: Those necessary after the first 72 hours.
Risk Assessment of Your Essential Records
Experts recommend following the Business Continuity Lifecycle model which includes four steps to strengthen essential records security and disaster preparedness. The steps include Risk Assessment, Impact Assessment, Strategic Planning, and Testing Procedures.
Risk Assessment: Identify and evaluate the risks to your essential records. Records can be damaged or lost due to a variety of factors. When we think of damage and loss, we think of natural disasters such as tornadoes or hurricanes; however, there are many other ways that records can be lost or damaged including cyber security threats and human error. Document the potential threats or risks to your building, workspaces, and daily business operations. This may include analyzing the physical and geographic location of the office, environmental conditions in the building and surrounding area, weather-related threats common to the area, technological vulnerabilities, and security procedures in place.
Impact Assessment: Next, discuss and document what people, places, providers, processes, programs, and procedures would be impacted by the risk threats identified. Prioritize the levels of significance by considering the steps necessary to restore operations and resources. This information should be updated once a year in your risk management plan.
Essential Records Protection Planning for Business Continuity
After you determine what records are essential and have calculated the risks to them, next is to develop preparedness and mitigation strategies to protect and ensure swift action and access to those resources when needed. Having a plan and being able to articulate it to the public builds confidence that your organization protects records access and provides business continuity despite a data breach or natural disaster.
Committing dedicated time for business continuity planning is often the biggest barrier to protecting your records from unexpected events. With the right tools, information, and advice, developing a useful plan is easier than you might think.
Strategic Planning: Take time to understand and map out the risks within your control. Know who provides mission-critical support to the operations of your organization. This could include documenting contact information for key personnel, service providers, and local agencies whose support may be critical in a recovery effort. Update this document on a regular basis.
Testing Procedures: Normally, a very low percentage of records are deemed essential in the beginning hours of a disaster. However, as the disruption time increases, so does the cost of losing other records and resources. Measure the potential impact of different levels of data loss events by testing your disaster planning procedures regularly.
Ensure Essential Records are Protected and Available When Needed
Experiencing a disruption in business continuity, a data loss event, or a natural disaster can be devastating. For those charged with record keeping, restoring normal operations can be daunting. Staff can become overwhelmed, procedures must be changed, and recovery can be costly.
Ensuring access to your data independent of outside sources, IT, or vendors can optimize your ability to regain operations efficiently. VaultTek provides clients with direct access to their critical and essential records through a local backup in addition to off-site data centers, meaning faster recovery and fewer opportunities for disrupted business.
- A triple-redundant system that stores backup files at three unique locations.
- On-site backup accessibility for quicker recovery should the worst occur.
- Individual support by entrusted experts that you will know by name.
- Systems developed for the unique challenges related to securing public-sector records.
Prioritizing, protecting, and having quick and easy access to your essential records will speed the resumption of operations. Your proactive steps in disaster preparedness provides business continuity and builds trust with those you serve.